Last verified: October 2026, against WordPress.com's terms and support center, Automattic's policies, Jetpack documentation and the HIPAA Security Rule. General information, not legal advice.
Is WordPress HIPAA compliant? WordPress is software, not a vendor, so it can't be compliant or non-compliant on its own. The answer depends on three things you control: the company that hosts it (and whether it signs a business associate agreement), every plugin that touches patient information, and how you manage admin access and updates.
Short answer: is WordPress HIPAA compliant?
Short answer (verified October 2026): It depends on where and how you run it. On WordPress.com, we found no BAA offer: its Terms of Service (opens in a new tab) (updated October 6, 2026) don't mention HIPAA, and its support center has no HIPAA article, so don't collect patient information there. Self-hosted WordPress can be part of a HIPAA-compliant setup if your host signs a BAA, each plugin that handles entries is covered, and admin access, updates and logging meet the Security Rule.
Search demand is small: "is wordpress hipaa compliant" gets about 40 searches a month and "wordpress hipaa" 30 (CPC $40.17) (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
WordPress.com vs self-hosted WordPress
Most answers online blur these two. They're different products with different HIPAA answers.
| Item | WordPress.com | Self-hosted WordPress |
|---|---|---|
| Who runs the servers | Automattic | The host you choose |
| BAA available? | None found in its terms or support center (Oct 2026) | Depends on the host |
| Who picks plugins | Limited by plan | You |
| Who applies updates | Automattic, mostly | You, your host or your developer |
| Fit for patient information | Brochure-only, unless you embed a BAA-covered form | Possible with the setup below |
Automattic's privacy policy (opens in a new tab) (updated December 11, 2025) doesn't mention HIPAA, and the WordPress VIP security page (opens in a new tab) lists FedRAMP Moderate and SOC 2 Type 2 among its credentials but says nothing about HIPAA.
Hosting, backups and the BAA
HIPAA calls a vendor a business associate when it "creates, receives, maintains, or transmits protected health information" for a covered entity (45 CFR 160.103 (opens in a new tab)). If your WordPress database stores form entries, your host maintains that protected health information (PHI), and so does whoever stores your backups.
Ask your host three questions in writing:
- Will you sign a BAA for the plan we're on, and does it cover backups and staging copies?
- Where are the database and backups stored, and for how long?
- Who on your side can access our database, and is that access logged?
If the host won't sign, don't store entries in WordPress. Embed a form service that signs a BAA so entries never touch your server. HIPAA compliant hosting covers what else to look for.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Plugins: forms, analytics, chat and security
Every plugin that stores or sends patient information needs its own check. Use Jetpack's form block as a worked example of what to look for (Jetpack Forms (opens in a new tab)):
- Storage: responses are saved in your site's database by default, and you can turn that off.
- Email: responses are emailed to a recipient you choose, including the submitter's name, email, message, IP address and timestamp.
- Third parties: if Akismet is enabled, form data is sent to the Akismet service for spam checking.
Run the same three questions for each plugin category:
- Forms and CRM plugins. Where do entries live, and do they leave the site? For plugin-by-plugin detail, see HIPAA compliant WordPress forms.
- Analytics and ad tags. What do they record on pages with forms or booking widgets? Remove them from those pages if you don't need them there.
- Chat. A chat widget's maker receives whatever visitors type, symptoms included. It needs a BAA or it shouldn't be on the site.
- Backup and security plugins. Many copy your database to their own cloud. That cloud holds every entry too.
Admin access, updates and audit trails
The HIPAA Security Rule's technical safeguards translate into a short list for a WordPress admin (45 CFR 164.312 (opens in a new tab)). For the full rule, see the HIPAA Security Rule.
| Security Rule standard | What it means in WordPress |
|---|---|
| Access control, unique user identification (required) | One login per person; no shared "admin" account |
| Automatic logoff (addressable) | Short session timeouts for accounts that can see entries |
| Encryption (addressable) | HTTPS everywhere; encrypt stored entries or don't store them |
| Audit controls | An activity log showing who viewed, exported or deleted entries |
| Integrity | Prompt core, theme and plugin updates; tested backups |
| Person or entity authentication | Two-step sign-in for every account with access to entries |
| Transmission security | No entries sent through email that no BAA covers |
Keep editor and author roles away from form entries, and remove accounts the day someone leaves.
A HIPAA-minded WordPress setup
- Decide if the site needs to collect anything. A brochure site with a phone number and a link to a BAA-covered scheduler is the simplest compliant WordPress site.
- If it collects, choose the path: embed a BAA-covered form service (entries never touch WordPress), or store entries on a host that signs a BAA.
- Inventory plugins. Delete what you don't use; check the rest for where data goes.
- Lock down accounts with unique logins, two-step sign-in and least privilege.
- Turn on activity logging and review it monthly.
- Patch on a schedule, with a named person responsible.
- Set retention. Delete entries once they're in your practice system, and confirm backups age out too.
A heavily customized theme makes several of these harder. WordPress themes vs custom sites weighs that trade-off. For other platforms, see the HIPAA checks for website builders.
Alternative to maintaining WordPress: Medfy is not a do-it-yourself builder. It rebuilds your practice's website and hosts it on your own domain, with HIPAA-compliant forms. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with your practice. You see a free preview of the rebuilt site first: start with a free audit and site preview, or read how Medfy handles patient data.
Frequently asked questions
Can a WordPress site be HIPAA compliant?
A self-hosted WordPress site can be part of a HIPAA-compliant setup, but the software alone decides little. You need a host that signs a BAA if form entries or backups hold patient information, plugins that don't send entries to vendors without BAAs, unique admin logins, prompt updates and activity logging. A brochure-only WordPress site that collects nothing avoids most of this work.
Does WordPress.com sign a BAA?
We found no sign of one as of October 2026. WordPress.com's Terms of Service, updated October 6, 2026, don't mention HIPAA or business associate agreements, its support center has no HIPAA article, and Automattic's privacy policy doesn't address HIPAA either. Without a signed BAA, don't collect patient information on a WordPress.com site: keep it brochure-only or embed a BAA-covered form.
Which WordPress plugins are HIPAA compliant?
No plugin makes a site compliant on its own. What matters is where each plugin stores or sends patient information: your database, an email, the plugin maker's cloud or a connected app. Jetpack's form block, for example, saves responses in your database, emails them and can pass them to Akismet for spam checks. Check each plugin's documentation, and get a BAA from any vendor that receives entries.